Masking the GLP Lattice-Based Signature Scheme at Any Order

Masking the GLP Lattice-Based Signature Scheme at Any Order Gilles Barthe1, Sonia Bela¨ıd2, omas Espitau3, Pierre-Alain Fouque4, Benjamin Gregoire´ 5, Melissa´ Rossi6;7, and Mehdi Tibouchi8 1 IMDEA Soware Institute [email protected] 2 CryptoExperts [email protected] 3 Sorbonne Universite,´ Laboratoire d’informatique de Paris VI [email protected] 4 Universite´ de Rennes [email protected] 5 Inria Sophia Antipolis [email protected] 6 ales 7 Ecole´ Normale Superieure´ de Paris, Departement´ d’informatique, CNRS, PSL Research University, INRIA [email protected] 8 NTT Secure Platform Laboratories [email protected] Abstract. Recently, numerous physical aacks have been demonstrated against laice- based schemes, oen exploiting their unique properties such as the reliance on Gaussian distributions, rejection sampling and FFT-based polynomial multiplication. As the call for concrete implementations and deployment of postquantum cryptography becomes more pressing, protecting against those aacks is an important problem. However, few countermeasures have been proposed so far. In particular, masking has been applied to the decryption procedure of some laice-based encryption schemes, but the much more dicult case of signatures (which are highly non-linear and typically involve randomness) has not been considered until now. In this paper, we describe the rst masked implementation of a laice-based signature scheme. Since masking Gaussian sampling and other procedures involving contrived prob- ability distribution would be prohibitively inecient, we focus on the GLP scheme of Guneysu,¨ Lyubashevsky and Poppelmann¨ (CHES 2012). We show how to provably mask it in the Ishai–Sahai–Wagner model (CRYPTO 2003) at any order in a relatively ecient man- ner, using extensions of the techniques of Coron et al. for converting between arithmetic and Boolean masking. Our proof relies on a mild generalization of probing security that supports the notion of public outputs. We also provide a proof-of-concept implementation to assess the eciency of the proposed countermeasure. Keywords: Side-channel, Masking, GLP laice-based signature 1 Introduction As the demands for practical implementations of postquantum cryptographic schemes get more pressing ahead of the NIST postquantum competition and in view of the recommendations of various agencies, understanding the security of those schemes against physical aacks is of paramount importance. Laice-based cryptography, in particular, is an aractive option in the postquantum seing, as it allows to design postquantum implementations of a wide range of primitives with strong security guarantees and a level of eciency comparable to currently de- ployed RSA and elliptic curve-based schemes. However, it poses new sets of challenges as far as side-channels and other physical aacks are concerned. In particular, the reliance on Gaussian distributions, rejection sampling or the number-theoretic transform for polynomial multiplication have been shown to open the door to new types of physical aacks for which it is not always easy to propose ecient countermeasures. e issue has in particular been laid bare in a number of recent works for the case of laice- based signature schemes. Laice-based signature in the random oracle model can be roughly di- vided into two families: on the one hand, constructions following Lyubashevsky’s “Fiat–Shamir with aborts” paradigm [25], and on the other hand, hash-and-sign signatures relying on laice trapdoors, as introduced by Gentry, Peikert and Vaikuntanathan [21]. Aempts have been made to implement schemes from both families, but Fiat–Shamir signatures are more common (al- though their postquantum security is admiedly not as well grounded). e underlying framework is called Fiat–Shamir with aborts because, unlike RSA and discrete logarithm-based constructions, laice-based constructions involve sampling from sets that do not admit a nice al- gebraic structure. A na¨ıve sampling algorithm would leak partial key information, in much the same way as it did in early heuristic schemes like GGH and NTRUSign; this is avoided by forc- ing the output signature to be independent of the secret key using rejection sampling. Many instantiations of the framework have been proposed [25,26,23,17,29], some of them quite e- cient: for example, the BLISS signature scheme [17] boasts performance and key and signature sizes roughly comparable to RSA and ECDSA signatures. However, the picture becomes less rosy once physical aacks are taken into account. For instance, Groot Bruinderink et al. [8] demonstrated a cache aack targeing the Gaussian sampling of the randomness used in BLISS signatures, which recovers the entire secret key from the side-channel leakage of a few thousand signature generations. Fault aacks have also been demonstrated on all kinds of laice-based signatures [19,7]. In particular, Espitau et al. recover the full BLISS secret key using a single fault on the generation of the randomness (and present a similarly ecient aack on GPV-style signatures). More recently, ACM CCS 2017 has featured several papers [20,28] exposing further side-channel aacks on BLISS, its variant BLISS–B, and their implementation in the strongSwan VPN soware. ey are based on a range of dierent side channels (cache aacks, simple and correlation electromagnetic analysis, branch tracing, etc.), and some of them target new parts of the signature generation algorithm, such as the rejection sampling. In order to protect against aack such as these, one would like to apply powerful countermeasures like masking. However, doing so eciently on a scheme like BLISS seems hard, as discussed in [20]. Indeed, the sampling of the Gaussian randomness in BLISS signature generation involves either very large lookup tables, which are expensive to mask eciently, or iter- ative approaches that are hard to even implement in constant time–let alone mask. Similarly, the rejection sampling step involves transcendental functions of the secret data that have to be computed to high precision; doing so in masked form seems daunting. 2 However, there exist other laice-based signatures that appear to support side-channel countermeasures like masking in a more natural way, because they entirely avoid Gaussians and other contrived distributions. Both the sampling of the randomness and the rejection sampling of signatures target uniform distributions in contiguous intervals. Examples of such schemes include the GLP scheme of Guneysu,¨ Lyubashevsky and Poppelmann¨ [23], which can be seen as the ancestor of BLISS, and later variants like the Dilithium scheme of Ducas et al. [18] (but not Dilithium-G). In this paper, we show how to eciently mask the GLP scheme at any masking order, so as to achieve security against power analysis and related aacks (both simple power analysis and higher-order aacks like dierential/correlation power analysis). is is to the best of our knowledge the rst time a masking countermeasure has been applied to protect laice-based signatures. Related work. Masking is a well-known technique introduced by Chari, Rao and Rohatgi at CHES 2002 [9] and essentially consists in spliing a secret value into d + 1 ones (d is thus the masking order), using a secret sharing scheme. is will force the adversary to read many in- ternal variables if he wants to recover the secret value, and he will gain no information if he observes fewer than d values. e advantage of this spliing is that linear operations cost noth- ing, but the downside is that non-linear operations (such as the AES S-box) can become quite expensive. Later, Ishai, Sahai and Wagner [24] developed a technique to prove the security of masking schemes in the threshold probing model (ISW), in which the adversary can read o at most d wires in a circuit. Recently, Duc, Dziembowski and Faust [16] proved the equivalence between this threshold model and the more realistic noisy model, in which the adversary ac- quires leakage on all variables, but that leakage is perturbed with some noise distribution, as is the case in practical side-channel aacks. Since the ISW model is much more convenient for designing and proving masking countermeasures, it is thus preferred, as the equivalence results of Duc et al. ultimately ensure that a secure implementation in the ISW model at a suciently high masking order is going to be secure against practical side-channel aacks up to a given signal-to-noise ratio. Masking has been applied to laice-based encryption schemes before [31,30]. However, in these schemes, only the decryption procedure needs to be protected, and it usually boils down to computing a scalar product between the secret key and the ciphertext (which is a linear operation in the secret data) followed by a comparison (which is non-linear, but not very dicult to mask). Oder et al. [27] point out a number of issues with those masked decryption algorithms, and describe another one, for a CCA2-secure version of Ring-LWE public-key encryption. Our results. Masking laice-based signatures, even in the comparatively simple case of GLP, turns out to be surprisingly dicult—possibly more so than any of the previous masking countermeasures considered so far in the literature. e probabilistic nature of signature generation, as well as its reliance on rejection sampling, present challenges (both in terms of design and of proof techniques) that had not occurred in earlier schemes, most of them deterministic. In addi- tion, for performance reasons, we are led to require a stronger security property of the original, unprotected signature scheme itself, which we have to establish separately. More precisely, the following issues arise. Conversion between Boolean and mod-p arithmetic masking. Most steps of the signing algorithm n involve linear operations on polynomials in the ring R = Zp[x]=(x + 1). ey can thus be 3 masked very cheaply using mod-p arithmetic masking: each coecient is represented as a sum of d + 1 additive shares modulo p.

Load more